Privacy Policy

Steffen Kotschi, Hamburg, Germany — hallo@skotschi.com. Further details are listed in the Impressum.

A data protection officer is not required for this site: it involves neither large-scale or systematic monitoring of visitors nor the processing of special categories of data (Art. 37 GDPR).

This is a static portfolio site with minimal data processing. There are no ads, no marketing trackers, and no cookie consent banner — none of that is needed, because everything described below is either strictly necessary to run the site or based on a legitimate interest in understanding basic traffic.

This site is hosted on Vercel Inc. Every request to the server necessarily creates log entries containing the visitor's IP address, the requested page, browser/OS information, and a timestamp. These are Vercel's standard hosting access logs, used only to operate and secure the site (Art. 6(1)(f) GDPR — legitimate interest in a functioning, secure website).

On this site's hosting plan (Vercel Hobby), these runtime logs are retained for up to 1 hour before being deleted, and are not exported or stored anywhere else.

A data processing agreement (DPA) is in place with Vercel. Vercel may process data in the United States; this transfer is covered by the EU Standard Contractual Clauses (SCCs).

This site uses Vercel Analytics to understand aggregate traffic — page views, referrers, country, and device/browser/OS category. Vercel Analytics is cookieless: it does not set a tracking cookie or fingerprint individual visitors, and figures are derived from pseudonymized request data rather than a persistent identifier. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding how the site is used).

Session cookie (portfolio_session): set only after you enter the correct password to unlock protected content (some case studies and the CV). It is httpOnly and encrypted, valid for 7 days, and stores nothing beyond a boolean authentication flag. This cookie is strictly necessary to keep you signed in to content you've already unlocked, so no consent is required for it (§ 25(2) TDDDG, Art. 6(1)(b) GDPR).

Theme preference: your light/dark mode choice is stored in your browser's localStorage (key: theme) so the site remembers it on your next visit. This never leaves your browser and is never sent to the server.

All fonts (Space Grotesk, Geist, Geist Mono) are self-hosted: downloaded once at build time and served from this domain via next/font. Your browser never contacts Google's font servers, and no request or IP address is ever sent to Google when a font loads.

Under the GDPR you have the right to: access the personal data we hold about you (Art. 15), have inaccurate data corrected (Art. 16), have it erased (Art. 17), restrict how it's processed (Art. 18), receive it in a portable format (Art. 20), and object to processing based on legitimate interest (Art. 21). If you've given consent to something, you can withdraw it at any time without affecting processing already carried out (Art. 7(3)).

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for this site is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, HmbBfDI); you may also contact the authority in your own EU member state.

To exercise any of these rights, contact hallo@skotschi.com.